CVE-2026-119084

HighCVSS 8.1

Published: 03/11/2026(UTC)Updated: 06/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

39th percentile - higher than 39% of all known CVEs

Summary

Amazon Redshift JDBC Driver before 2.3.0 contains unsafe reflection in the handling of connection parameters and credentials profiles. An actor who can influence the JDBC connection URL or the AWS credentials profile may execute arbitrary code in the application context, provided a suitable class is available on the application classpath.

Risk Assessment

This vulnerability may allow remote code execution in applications using Redshift JDBC if an attacker controls connection parameters or credential configuration. Exploitation requires a suitable class to be present on the application classpath.

Recommendation

Upgrade Amazon Redshift JDBC Driver to version 2.3.0 or later. Additionally, restrict the ability of untrusted sources to modify the JDBC connection URL and credentials profiles.

Other vulnerabilities in Amazon Redshift JDBC Driver

CVE-2026-8178High
An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2 that could allow arbitrary classes to be loaded and executed when processing JDBC connection URL parameters.

Original NVD description (English source)

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath. To remediate this issue, users should upgrade to version 2.3.0 or later.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS